At some point the web interface crapped out with the nginx “bad-gateway” error, hence I chose option 16 to restart the back-end. Eventually the unit simply became unreachable.
I can only hope that a hard reboot (later today when someone is on site), will bring it back to a point where at least I can log into the console.

But THE BIG QUESTION here is this:

Why make available an incomplete update? It downloads everything, and then the last file times out, repeatedly; and it seems to leave the unit in an undefined state. Not very cool…